Preview a team invitation (accept-page context)

GET

/v1/auth/invite/{token}

curl --request GET \
  --url http://localhost:8080/v1/auth/invite/example

• Local development

Unauthenticated — the token IS the credential (mirrors password reset). Returns the invited email, workspace name, and whether the invitee needs to create an account. Invalid, expired, revoked, and already-used tokens all return the same generic 422 (no state oracle for token guessing). ADR-081.

Parameters

Path Parameters

token

required

string

Responses

200

Invitation preview

Media typeapplication/json

object

email

required

string

tenant_id

required

string

tenant_name

required

string

needs_new_account

required

boolean

invited_by_email

required

string

expires_at

required

string format: date-time

Example ^generated

{
  "email": "example",
  "tenant_id": "example",
  "tenant_name": "example",
  "needs_new_account": true,
  "invited_by_email": "example",
  "expires_at": "2026-04-15T12:00:00Z"
}

422

Token invalid, expired, revoked, or already used

Media typeapplication/json

object

error

object

type

One of invalid_request_error, authentication_error, rate_limit_error or api_error. Every error the API answers has this shape, including an unknown path (404, code route_not_found) and a method the path does not take (405, code method_not_allowed, with an Allow header). The few exceptions are listed in docs/api-surface.md.

string

code

string

message

string

request_id

string

param

The request field the error is about. Sent only when the error names one. A request body may hold only the fields its operation lists, spelled and cased as listed: any other field, or one the server sets (such as id), is refused with 422 and param naming it. An operation with no request body lists no fields: send no body, {} or null. The Stripe and Postmark webhooks and the LiteLLM callback take their sender’s body as it comes.

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}